AIKIDO-2026-613007

TL;DR

The migration op event serializer inlined the raw evaluation context instead of the redacted context view used by every other inline event type. When an application records migration operation metrics for contexts that declare private attributes, are covered by globally configured private attributes, or run with all-attributes-private mode, those private attribute values are serialized in plaintext into the outbound migration_op analytics payload. Private data the application explicitly marked as private therefore leaves the SDK even though it is redacted in ordinary events. The fix routes the migration context through the same shared ContextAttributes redaction path as BaseEvent so private attributes are stripped before events are sent.